Compliance programmes
A programme is the long-lived container for one framework's assessment work. It is what you keep across years; the engagements inside it are what you run each year. Vantage calls them projects in the navigation.
The distinction matters because the two things answer different questions. An engagement answers how compliant were we in 2026. A programme answers how has our ISO 27001 posture moved since we started. Sign-off, evidence and findings all live on the engagement; the programme just holds the thread.
Creating one
Projects → New project.
| Field | Notes |
|---|---|
| Project name | What you will recognise the programme by, e.g. "ISO 27001 programme". |
| Arabic name | Optional. Shown instead of the English name when the platform is set to Arabic. |
| Description | What the programme covers. Shown on the card and the detail page. |
| Framework | The standard the programme assesses against. |
Creating a programme needs a manager or above; the New project button only appears for those who can use it. If the create fails — a framework that has since been removed, a permission that changed while the form was open — the reason is shown on the form rather than in a silent console message.
Arriving from a framework's page with Start compliance program (or Start new program, when the framework already has one) pre-selects that framework.
The programme page
The card list shows each programme's framework, when it was created, its status and how many engagements it holds. Opening one lists those engagements newest first, each with its own status, so the history of a standard reads as a single column.
A programme carries a status of its own — active, completed or archived — which a manager sets from the programme page. It is descriptive: it does not gate anything, and it does not change what the engagements inside it can do. Use completed for a standard you have finished assessing against and archived for one you have stopped tracking; both keep every engagement, workpaper and report exactly as they are.
Deleting
A programme can only be deleted when it is empty. If it still holds engagements, the delete is refused and says how many.
This is deliberate, and it is the only safe answer. A programme is a container; its engagements hold the workpapers, evidence, findings and sign-offs. A completed engagement is a point-in-time record that cannot be hard-deleted at all — it must be reopened first — and letting a container take one with it would be a way around that rule rather than an exception to it. Empty the programme one engagement at a time, where the rule applies to each, and then remove the folder.
Related pages
- Running an assessment — creating an engagement inside a programme and carrying last year's work forward.
- Frameworks — where the control set comes from.
- Reporting — reading a programme's posture over time.